WHAT IS CLAIMED IS: 



1 1 . A method of monitoring an element in a computer network, said method 

2 comprising: 

3 monitoring a preselected variable relating to said element; 

4 defining a threshold for the monitored preselected variable; 

5 establishing a sliding window in time; 

6 repeatedly generating a time above threshold value, said time above threshold value 

7 being a measure of an amount of time during which the monitored variable exceeded the 

8 threshold during the sliding window of time; 

9 detecting when the time above threshold value exceeds a condition window value; 

10 and 

1 1 in response to detecting when the time above threshold value exceeds said condition 

12 window, generating an alarm. 

1 2. The method of claim 1 further comprising after generating an alarm, maintaining 

2 the alarm at least as long as the time above threshold value exceeds a clear window value. 

1 3. The method of claim 2 wherein said clear window value is equal to said condition 

2 window value. 

1 4. The method of claim 3 further comprising: 

2 monitoring a plurality of variables relating to said element, said preselected variable 

3 being one of said plurality of variables; and 

4 for each of the plurality of monitored variables, defining a corresponding threshold 

5 for that other variable, wherein the time above threshold value is a measure of an amount of 

6 time during which any one or more of the monitored variables exceeded its corresponding 

7 threshold during the corresponding sliding window of time. 

1 5. The method of claim 1 wherein the step of defining the threshold for the 

2 preselected variable comprises: 

3 computing an average value for the preseleted variable based on values obtained for 

4 the preselected variable over a corresponding prior period; 
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5 defining an excursion amount; and 

6 setting the threshold equal to a sum of the average value plus the excursion amount. 

1 6. The method of claim 5 wherein the corresponding period of time is less than a day. 

1 7. The method of claim 6 wherein the corresponding period of time is a particular 

2 hour period of a day. 

1 8. The method of claim 6 wherein the step of computing the average comprises 

2 computing a mean value for the preselected variable using values obtained for that 

3 preselected variable for the same hour period of the same day of the week for a 

4 predetermined number of previous weeks. 

1 9. The method of claim 5 wherein the step of defining an excursion amount 

2 comprises: 

3 computing a standard deviation for the preselected variable based on values obtained 

4 for the preselected variable over a predetermined period of time; and 

5 setting the excursion amount equal to K times the computed standard deviation, 

6 wherein K is a positive number. 

1 10. The method of claim 9 wherein the step of computing the standard deviation 

2 comprises computing the standard deviation using values obtained for that preselected 

3 variable for the same hour period of the same day of the week for a predetermined number of 

4 previous weeks. 

1 11. The method of claim 1 wherein the step of defining the threshold for the 

2 preselected variable comprises: 

3 defining an excursion amount; and 

4 setting the threshold equal to H less the excursion amount, where H is a positive 

5 number. 

1 12. The method of claim 1 1 wherein the step of defining an excursion amount 

2 comprises: 
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3 computing a standard deviation for the preselected variable based on values obtained 

4 for the preselected variable over a predetermined period of time; and 

5 setting the excursion amount equal to K times the computed standard deviation, 

6 wherein K is a positive number. 

1 1 3 . A method of monitoring an element in a computer network, said method 

2 comprising: 

3 defining a profile for that element, said profile including a plurality of different alarm 

4 rales, each of said different alarm rules establishing an alarm test for a corresponding one or 

5 more variables; 

6 detecting when the alarm test for any one or more of the plurality of different alarm 

7 rules is met; 

8 repeatedly generating a time above threshold value, said time above threshold value 

9 being a measure of an amount of time during which any one or more of the alarm tests has 

I o been met during a preselected prior window of time; 

I I detecting when the time above threshold value exceeds a condition window value; 

12 and 

13 in response to detecting when the time above threshold value exceeds said condition 

14 window, generating an alarm. 

1 14. The method of claim 1 3 further comprising after generating an exception, 

2 maintaining that exception at least as long as the time above threshold value exceeds a clear 

3 window value. 

1 15. A method of displaying on a computer display screen historical performance of 

2 an element on a network, said method comprising: 

3 monitoring performance of the element; 

4 for each of the plurality of time slots, deriving a measure of performance for the 

5 element from its monitored performance; 

6 for each of a plurality of time slots, computing an average value for the measure of 

7 performance of the element; 

8 for each of the plurality of time slots, computing a variability for the measure of 

9 performance; and 
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10 on the computer display screen and for each of the plurality of time slots: (1) 

1 1 displaying a first indicator of the computed average value for that time slot; (2) a second 

12 indicator of the computed variability for that time slot; and (3) a third indicator of the derived 

1 3 measure of performance for that time slot. 

1 1 6. A computer program stored on a computer-readable medium for causing a 

2 computer system to perform the functions of: 

3 monitoring a preselected variable relating to an element of a computer network; 

4 defining a threshold for the monitored preselected variable; 

5 establishing a sliding window in time; 

6 repeatedly generating a time above threshold value, said time above threshold value 

7 being a measure of an amount of time during which the monitored variable exceeded the 

8 threshold during the sliding window of time; 

9 detecting when the time above threshold value exceeds a condition window value; 

10 and 

1 1 in response to detecting when the time above threshold value exceeds said condition 

12 window, generating an alarm. 

1 1 7. A computer program for monitoring an element in a computer network, said 

2 program stored on a computer-readable medium for causing a computer system to perform 

3 the functions of: 

4 defining a profile for that element, said profile including a plurality of different alarm 

5 rules, each of said different alarm rules establishing an alarm test for a corresponding one or 

6 more variables; 

7 detecting when the alarm test for any one or more of the plurality of different alarm 

8 rules is met; 

9 repeatedly generating a time above threshold value, said time above threshold value 

10 being a measure of an amount of time during which any one or more of the alarm tests has 

1 1 been met during a preselected prior window of time; 

12 detecting when the time above threshold value exceeds a condition window value; 

13 and 
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14 in response to detecting when the time above threshold value exceeds said condition 

15 window, generating an alarm. 

1 1 8. A computer program for displaying on a computer display screen historical 

2 performance of an element on a network, said program stored on a computer-readable 

3 medium for causing a computer system to perform the functions of: 

4 monitoring performance of the element; 

5 for each of the plurality of time slots, deriving a measure of performance for the 

6 element from its monitored performance; 

7 for each of a plurality of time slots, computing an average value for the measure of 

8 performance of the element; 

9 for each of the plurality of time slots, computing a variability for the measure of 

10 performance; and 

1 1 on the computer display screen and for each of the plurality of time slots: (1) 

12 displaying a first indicator of the computed average value for that time slot; (2) a second 

13 indicator of the computed variability for that time slot; and (3) a third indicator of the derived 

14 measure of performance for that time slot. 
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